This update to ClamAV version 0.88.7 fixes various bugs :

CVE-2006-5874: Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a NULL pointer dereference.

CVE-2006-6481: Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.

CVE-2006-6406: Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-6406     Hendrik Weimer discovered that invalid characters in     base64 encoded data may lead to bypass of scanning     mechanisms.

  - CVE-2006-6481     Hendrik Weimer discovered that deeply nested     multipart/mime MIME data may lead to denial of service.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

The remote host is affected by the vulnerability described in GLSA-200612-18 (ClamAV: Denial of Service)

    Hendrik Weimer discovered that ClamAV fails to properly handle deeply     nested MIME multipart/mixed content.
  Impact :

    By sending a specially crafted email with deeply nested MIME     multipart/mixed content an attacker could cause ClamAV to crash.
  Workaround :

    There is no known workaround at this time.

The latest version of ClamAV, 0.88.7, fixes some bugs, including vulnerabilities with handling base64-encoded MIME attachment files that can lead to either a) a crash (CVE-2006-5874), or b) a bypass of virus detection (CVE-2006-6406).

As well, a vulnerability was discovered that allows remote attackers to cause a stack overflow and application crash by wrapping many layers of multipart/mixed content around a document (CVE-2006-6481).

The latest ClamAV is being provided to address these issues.

Secunia reports :

Clam AntiVirus have a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a stack overflow when scanning messages with deeply nested multipart content. This can be exploited to crash the service by sending specially crafted emails to a vulnerable system.

This update to ClamAV version 0.88.7 fixes various bugs :

  - Clam AntiVirus (ClamAV) allows remote attackers to cause     a denial of service (crash) via a malformed     base64-encoded MIME attachment that triggers a NULL     pointer dereference. (CVE-2006-5874)

  - Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers     to cause a denial of service (stack overflow and     application crash) by wrapping many layers of     multipart/mixed content around a document, a different     vulnerability than CVE-2006-5874 / CVE-2006-6406.
    (CVE-2006-6481)

  - Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers     to bypass virus detection by inserting invalid     characters into base64 encoded content in a     multipart/mixed MIME file, as demonstrated with the     EICAR test file. (CVE-2006-6406)

The remote host is running the ClamAV antivirus client version.
This version of ClamAV is vulnerable to a flaw where file scanning can be bypassed by passing malformed MIME-encoded requests.  An attacker exploiting this flaw would be able to send malicious files through the antivirus product without detection. 

ID	Name	Product	Family	Published	Updated	Severity
27177	openSUSE 10 Security Update : clamav (clamav-2391)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	medium
23912	Debian DSA-1238-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	12/18/2006	1/4/2021	medium
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	3/19/2008	7/14/2018	critical
23955	GLSA-200612-18 : ClamAV: Denial of Service	Nessus	Gentoo Local Security Checks	12/30/2006	1/6/2021	medium
24613	Mandrake Linux Security Advisory : clamav (MDKSA-2006:230)	Nessus	Mandriva Local Security Checks	2/18/2007	1/6/2021	medium
23853	FreeBSD : clamav -- Multipart Nestings Denial of Service (eb5124a4-8a20-11db-b033-00123ffe8333)	Nessus	FreeBSD Local Security Checks	12/14/2006	1/6/2021	medium
29397	SuSE 10 Security Update : clamav (ZYPP Patch Number 2390)	Nessus	SuSE Local Security Checks	12/13/2007	1/14/2021	medium
3842	ClamAV < 0.88.7 MIME-encoded Scan Bypass (deprecated)	Nessus Network Monitor	Web Clients	12/6/2006	3/6/2019	medium

Detections

Analytics

Plugins Search

medium

medium

critical

medium

medium

medium

medium

medium